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Abstract — We consider secret key generation from rela- 
tive localization information of a pair of nodes in a mobile 
wireless network in the presence of a mobile eavesdropper. 
Our proposed algorithm consists of the following phases: 
in the first phase, legitimate node pair opportunistically 
exchanges beacon signals to establish localization informa- 
tion based on noisy observations of these beacons. Then, 
the nodes generate secret key bits via a public discussion 
and privacy amplification. Our problem can be categorized 
under the source models of information theoretic secrecy, 
where the distance between the legitimate nodes acts as 
the observed common randomness. We also characterize 
theoretically achievable secret key bit rate in terms of 
the observation noise variance at the legitimate nodes and 
the eavesdropper, and show that the performance of our 
algorithm is comparable to the theoretical bounds. This 
work provides a framework that combines information 
theoretic secrecy and wireless localization, and proves 
that the localization information provides a significant 
additional resource for secret key generation in mobile 
wireless networks. 

I. Introduction 

We consider the generation of a common key in a 
pair of nodes, which move in M 2 (continuous space) 
according to a discrete time stochastic mobility model. 
We exploit the reciprocity of the distance between a 
given pair of locations, view the distance between the 
legitimate nodes as a common randomness shared by 
these nodes and utilize it to generate secret key bits using 
the ideas from source models of secrecy. 

To that end, we propose a key generation algorithm, 
in which the legitimate nodes use a four-stage key 
generation process: (1) In the first stage, they opportunis- 
tically exchange wireless beacons to obtain information 
regarding the sequence of distances between them over 
many time slots as they move in the area. The beacon 
signal may contain explicit information such as a time 
stamp, or the receiving node can extract other means 
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of localization information by analyzing the angle of 
arrival, the received signal strength, etc. (2) In the 
second stage, the nodes perform localization based on 
the observations of distances, and the statistics of the 
mobility model, and obtain estimates of their relative 
locations with respect to each other. (3) In the third 
stage, the nodes communicate over the public chan- 
nel to agree on an initial key based on their relative 
location estimates. Meanwhile, the eavesdropper also 
obtains some information correlated with the generated 
key. (4) In the final stage, the legitimate nodes perform 
privacy amplification on the initial key to obtain the 
final key. The generated final key bits satisfy the fol- 
lowing three quality measures i) reliability, ii) secrecy, 
and iii) randomness. For reliability, we show that the 
probability of mismatch between the keys generated by 
the legitimate nodes decays to with increasing block 
length. In our attacker model, we consider a single 
passive eavesdropper, that is not allowed to transmit any 
wireless signal, overhears the exchanged beacons in the 
first phase, and the public discussion in the third phase, 
and tries to deduce the generated key based solely on 
these observations. For secrecy, we consider Wyner's 
notion, i.e., the rate at which mutual information on 
the key leaks to the eavesdropper should be arbitrarily 
low. For randomness, the generated key bits have to be 
perfectly compressed, i.e., the entropy should be equal 
to the number of bits it contains. 

We also focus on the theoretical limits in key rate 
performance. Using a source model of secrecy, we char- 
acterize the achievable secret key bit rate in terms of the 
observation noise variance at the legitimate nodes and the 
eavesdropper under two different cases of global location 
information (GLI). We first consider no GLI, in which 
the nodes do not observe their global locations directly. 
Then we consider perfect GLI, in which nodes have 
perfect observation of their global locations, through a 
GPS device, for example. We show that, under both 
cases, localization information provides a significant 
additional resource for secret key generation. We also 
study the beacon power asymptotics of the system. We 
show a phase-transition phenomenon for the key rate, as 
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it varies relative to the eavesdropper's angle observation. 
In particular, we prove that the secret key rate grows 
unboundedly with the beacon power, if the eavesdropper 
does not obtain the angle of arrival observations of the 
beacon signals. Otherwise, even with a highly noisy 
angle of arrival observation, it is not possible to increase 
the secret key rate beyond a certain limit by increasing 
the beacon power. 

Assuming the beacon observations are readily avail- 
able, we implement our key generation algorithm and 
compare the achieved key rates with the established 
theoretical bounds as a function of beacon power. We 
show that our algorithm achieves key rate close to the 
theoretical lower bound at a bit mismatch probability 
less than 0.001 at the legitimate nodes and an informa- 
tion leakage rate of less than 0.001 bits/sample to the 
eavesdropper. For the measure of randomness, we use 
the NIST test suite l25l . We show that the generated key 
passes all the randomness tests in the NIST test suite. 

The opportunistic nature of our algorithm comes from 
the fact that the beacons are exchanged only when they 
predict a geographic advantage over the eavesdropper, 
based on their past observations. We show that non-zero 
key rates can be guaranteed by this opportunistic scheme, 
even when the eavesdropper obtains better localization 
information on average. We also study the eavesdrop- 
per's mobility strategies to reduce the secret key rate. We 
specifically consider the strategy where the eavesdropper 
moves to the middle of its location estimates of the 
legitimate nodes. We show through simulations that with 
this strategy, the eavesdropper can significantly reduce 
the secret key rate compared to the case where it follows 
a random mobility pattern. 

II. Related Work 

Source model of secrecy studies generation of secret 
key bits from common randomness observed by legit- 
imate nodes. In his seminal paper (TJ, Maurer showed 
that, if two nodes observe correlated randomness, then 
they can agree on a secret key through public discussion. 
He provided upper and lower bounds on the achiev- 
able secret key rates, considering that the nodes have 
unlimited access to a public channel, accessible by the 
eavesdropper. Although the upper and lower bounds have 
been improved later (2|, E), the secret key capacity of 
the source model in general is still an open problem. 
Despite this fact, the source model has been utilized in 
several different settings |01-||6|. 

There is a vast amount of literature on localization 
in wireless networks (see, e.g., Q-0, and the refer- 
ences therein). There has been some focus on secure 
localization and position-based cryptography lfT0l - lfT3l . 
however, these works either consider key generation 
in terms of other forms of secrecy (i.e., computational 



secrecy), or fall short of covering a complete information 
theoretic analysis. Also a similar line of work in wireless 
network secrecy considers channel identification lfT4l for 
secret key generation in Ultrawideband Channels. Based 
on the channel reciprocity assumption, nodes at both 
ends experience the same channel, corrupted by inde- 
pendent noise. Therefore, nodes can use their channel 
magnitude and phase response observations to generate 
secret key bits from public discussion. In J2T|, it is 
shown that key generation can also be achieved with on- 
the-shelf devices, where they show achievability of key 
rates above 1 bit/s under 802.11 development platform. 
In 1221 , effectiveness of key generation is questioned, 
focusing on a scenario in which the legitimate nodes 
generate secret key bits based on the received signal 
strength (RSS). The authors show that the eavesdropper, 
knowing the location of the legitimate nodes, can force 
the legitimate nodes to generate deterministic key bits by 
periodically blocking and un-blocking their line-of-sight. 
This paper shows the relationship between localization 
and channel identification. l23l focuses on overcoming 
this type of attack by considering key generation based 
on channel impulse response based on node locations. 
Keys are generated from a large amount of observations, 
and non-zero secret key bits are achieved with the 
assumption that the eavesdropper cannot always be in 
a geographical advantage. In ll24l . the authors improve 
upon the previous works by using more sophisticated 
signal processing methods to achieve secret key rates as 
high as 22 bits/s. 

As pointed out in l22l . localization is fundamentally 
related to key generation based on channel identification. 
The fact that the eavesdropper's channel observation is 
independent of the legitimate nodes' channel observa- 
tions may not be correct when the eavesdropper knows 
the locations of the legitimate nodes. Our approach of 
key generation based on locations, on the other hand, is 
fundamentally secure against a passive eavesdropper, as 
we can explicitly calculate the equivocation rate. 

The rest of this paper is organized as follows. In 
Section[ni] we give the system model, and in SectionllVl 
we provide our key generation algorithm. In Section [V] 
we study the theoretical performance limits of key 
generation from localization. In Section [VTl we provide 
numerical evaluation of the theoretical limits given in 
this paper, and compare the performance of our key 
generation algorithm with these limits. We conclude in 
Section IVIII To enhance the flow of the paper, several 
proofs and derivations are collected in Appendix. 

A word about notation: We use [x] + = max(0, x) and 
|| . || denotes the L2-norm.A brief list of variables used in 
the paper can be found in Table U 
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TABLE I: List of variables 



Description 



dj,4>j 
dj e 

°j 
7 
P 
s 

S A 

A 

i> 
$ 



distance between nodes i and j 

2-D location of node j 

angle between nodes i and j 

observation of nodes j S {1, 2} of d\2 and 4>j 

observation of node e of dj e and (f>j £ 

complete observations of node j based on available GLI 

Noise variance coefficient due to path loss 

Noise variance coefficient due to node capability 

location triple [li,l2,le] 

quantized version of location triple, [l^ ] 
quantization resolution 
quantization function 

node j's estimate of s A based on all of its information 
quantized distance estimates extracted from 
binary conversion function 

obtained binary key at node j before public discussion 
obtained binary key at node j after public discussion 
final key at node j after privacy amplification 



III. System Model 

A. Mobility Model 

We consider a simple network consisting of two 
mobile legitimate nodes, called user 1 and 2, and a 
possibly mobile eavesdropper e. We divide time into n 
discrete slots, where slot i £ {1, ■ • ■ , n} covers the time 
interval [il, (i + 1)1). Let £ R 2 be the random 
variable that denotes the coordinates of the location of 
node j £ {1, 2, e} in slot i. We use the boldface notation 
h = {(jH}r=i' t0 denote the n-tuple location vectors 
for j £ {l,2,e}. The distance between nodes 1 and 2 
in slot i is d 12 [i] = \\h[i] — h[i]\\- Similarly, di e [i] and 
d 2e [i] denote the sequence of distances between nodes 
(1, e) and nodes (2, e) respectively. We use the boldface 
notation di2, di e , d2 C for the ri-tuple distance vectors. 
Furthermore, let 4> e [i] be the angle of the triangle at 
node e at slot i, and e = {</> e [i]}™ = i- In any slot, the 
nodes form a triangle in R 2 , as depicted in Figure [T] 
We assume that the location vectors li , I2 , l e form an 




Fig. 1: Legitimate nodes and the eavesdropper form a 
triangle. 

ergodic Markov process, and their joint probability den- 
sity function /(li, I2, l e ) is well defined^. We assume 

'Note that, these assumptions are not vital for our key generation 
algorithm, rather are present for the ease of calculation of achievable 
key rates 



that the distances dia^'], die[i], d 2e [i] take values in the 
interval [d m - m d max ], since the nodes cannot be closer 
to each other than d m ; n due to physical restrictions, and 
they cannot be further than d max away to each other due 
to their limited communication range. 



B. Beacon Exchange 

At the beginning of each time slot, there is a beacon 
exchange period, in which the pair of nodes exchange 
beacon signals in order to obtain information about their 
relative position with respect to each other. There are 
various methods to establish the localization information 
from the beacon signals, e.g., by using the propagation 
delay (time of arrival) of electromagnetic signals J7)- In 
this paper, we will not treat these methods separately. We 
will simply assume that, during each beacon exchange 
period i, when node 1 transmits a beacon, nodes 2 
and e obtain a noisy observation of di2[i] and di e [i] 
respectively. Let these observation be d,2[i) and di e [i]. 
Similarly, when node 2 follows up with a beacon, 
nodes 1 and e observe di[i] and abeH, respectively. 
With the observations of both the beacons, the eaves- 
dropper also obtains a noisy observation, 4> e [i], of the 
angle between the legitimate nodes. We emphasize that, 
the observations in each slot are obtained solely from 
the beacons exchanged during that particular slot. The 
nodes' final estimates of the distances depend also on 
the observations during other slots, due to predictable 
mobility patterns. 

Note that the availability of global location informa- 
tion (GLI) at the legitimate nodes would also enable 
them to observe the angle between with respect to some 
coordinate plane (e.g., ^12 [i] as shown in Figure O. To 
that end, we consider the following two extreme cases: 

1) no GLI: the nodes do not have any knowledge of their 
global location, and 

2) perfect GLI: each node has perfect knowledge of its 
global location. 

Let Oj[i] denote the set of observations of node j £ 
{l,2,e} during slot i. The observations Oj[i] for each 
case is provided in Table [TT] Note that with perfect GLI, 
all nodes have a sense of orientation with respect to 
some coordinate plane as shown in Figure |2] In this 
case, nodes 1, 2 obtain noisy observations <j> 1 , <f> 2 of the 
angle <f> 12 . Similarly, node e obtains noisy observation 
4> le , 4> 2e of the angles 4> le ,cf> 2e . To develop our op- 

TABLE II: Nodes' Observations 





No GLI 


Perfect GLI 


01 [i] 

02 [i] 

Oe[i] 


[dim 

[di e [i],d 2e [i],(j>e[i]] 


[iiw.&ra.iiM] 

[<k[»Ua[t],«2[i]] 

[die [i] , d,2e [l], 4>le [«] , 02e [«] , le H] 



4 



>12l*J 



where 



<i>i2['i( 



\t>le[i] 



<))2eP] 



Fig. 2: With GLI, the nodes obtain noisy observations 
of the relative orientation of each other with respect to 
the x-axis. 



portunistic beacon exchange algorithm and analyze the 
key rate performance^, we specifically focus on the case 
where the nodes obtain distance and angle observations 
corrupted with additive Gaussian noise, i.e., 



dje [i] 



d u [i] + wj[i], je{l,2} 

d je [i] + w je [i], j e {1,2} 
<j> e [i] + w^li], 



(1) 
(2) 
(3) 



where 



-f(d 12 [i\)p 3 
P 



l(dje\i])Pe 
U ' P 



Wjlil-Afl 0, 
WH R [i]~J\f ( 0, 



^[f AT 0, 



l<t>( di e [i],d 2 e[i])Pe 
P 

Here, P is the beacon power, and 7 is an increasing 
function of the distance, and it solely depends on the 
characteristics of the wireless medium such as the path 
loss exponent. Similarly, r y < p(di e [i],d2 e [i]) determines 
the angle observation error, and is an increasing function 
of both distances di e [i] and G?2e[*]- The parameter pj, 
depends on the capability of the nodes, and is smaller 
for nodes with higher capability, e.g., with MIMO, or 
higher antenna gain. Similarly, the angle observations in 
the perfect GLI case follow Gaussian distribution 



+ ie {1,2} 
& e [*] + i%.[»] J 3 e {1,2} 



(4) 
(5) 
(6) 



2 Part of this model has been used in the literature to characterize the 
distance observation noise when time-of-arrival estimation technique 
is used (7), 1181 . In fact, the distance observation noise cannot be 
perfectly Gaussian. However, under the assumption E[7( )] <C d[-], 
the Gaussian assumption is reasonable. Furthermore, there there may 
be a bias on these observations due to small scale fading 1181 . The 
effect of biased observations are studied in Appendix [c] 



For perfect GLI, the angle information is obtained ac- 
cording to a fixed coordinate plane, hence the function 
70 has single argument. Clearly, the achievable key rates 
depend highly on the functions 7, 7^ and p. We will 
show that, our algorithm achieves non-zero secret key 
rates even when the eavesdropper is more capable, i.e., 
p e < pj, for j € {1,2}. In Section [VTl we evaluate 
the key rate performance of our algorithm for particular 
choices of 7, 7^ and p, and compare with the theoretical 
bounds provided in Section IV-AI 

We emphasize that, our key generation algorithm 
works in the general case, without the above assumptions 
on the distance and angle observations. In fact, we 
provide the theoretical key rate performance without 
these assumptions on Section IV-AI Also note that in 
some cases, the nodes cannot obtain any useful angle 
information. For instance, when each node is equipped 
with a single omnidirectional antenna, no angle ob- 
servation may be possible. Also in the indoor setting 
without the line of sight, due to multipath reflections, it 
may be unlikely that the strongest signal component is 
observed directly from the transmitting station, but from 
a reflection instead. Thus, the angle observation may 
contain only minimal information regarding the direction 
of the transmitter, making the angle information highly 
noisy for the eavesdropper. In our analysis of such cases, 
we use I{4»j\<j)j) = for legitimate nodes j E {1,2} 
in perfect GLI, I{4>j e ) 0j e ) = for the eavesdropper in 
perfect GLI, and I(<fi e ; <fi e ) = for the eavesdropper in 
no GLI. 

C. Attacker Model 

We assume that there exists a passive eavesdropper 
e, which does not transmit any beacons. However, we 
assume that e can strategically change its location to 
obtain a geographical advantage against the legitimate 
nodes. Overall, we consider two strategies: 
Random Mobility: Eavesdropper moves randomly, 
without a regard to the location of the legitimate nodes. 
We will assume that eavesdropper adopts random mo- 
bility unless otherwise stated. 

Mobile Man in the Middle: Node e controls its 
mobility, such that it can move accordingly to obtain 
a geographic advantage compared to legitimate nodes. 
Since the observation noise variances are monotonically 
increasing functions of the distance, we can see that it 
would be to the eavesdropper's advantage to stay in 
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between the legitimate nodes. Since the eavesdropper 
has an estimate of the current locations of the nodes, 
a reasonable strategy for it is to move to the mid-point 
of the most up to date estimates of the locations of the 
legitimate nodes. Thus, in slot i, the eavesdropper moves 
to location 

h,e[i- 1] +*~2, e [i- 1] m 

2 ' U) 

at the beginning of each slot i, where for j £ {1, 2}, 

h,S ~ 1] = maxP(Zj[i]|o e [l], . . . ,o e [i - 1]) 

is the estimate of the location lj [i — 1] given the eaves- 
dropper's observations until the i — l'th slot. 

D. Notion of security 

We consider the typical definition of source model 
of information theoretic secrecy under a passive eaves- 
dropper: We assume that there exists an authenticated 
error-free public channel, using which the legitimate 
nodes can communicate to agree on secret keys, based 
on the observations of the distances and angles (oi and 
02) obtained during beacon exchange. This process is 
commonly referred to as public discussion (TJ. A public 
discussion algorithm is a T step message exchange 
protocol, where at any step t S {1, • • • , T}, node 1 sends 
message C\[t], and node 2 replies back with message 
C 2 [t] such that, for t > 1, 

H{C 1 [t]\oxACi[i\}lz 1 1 ,{C 2 \i]}*z{)=0, odd 1 (8) 
^(C 2 [t]|o 2 ,{C 1 [ l ]}* =1 ,{C 2 W}*I 1 1 ) =0, even*. (9) 

At the end of the T step protocol, node 1 obtains ki, 
and node 2 obtains k 2 as the secret key, where 

H{k J \o J ,{C 1 [t},C 2 [t}}J =1 )=0, j e {1,2}. (10) 

Definition 1: We say that perfectly reliable key bits 
are generated (with respect to the described attacker 
model) at rate R, if, for all e > and 5 > 0, there 
exists some n, T > such that dU, © and ([Tol l are 
satisfied, and 

H(k j )/n = R, je{l,2} 
P(ki + k 2 ) < 6 
I(k ] ;o e ,{C 1 [t],C2[t\}^ 1 )/n < 5, j € {1,2}. (11) 

To achieve perfect reliability, schemes proposed in the 
source model of secrecy typically use a random cod- 
ing structure, where the messages {Ci[f], C2[t}}J =1 are 
generated by using a binning strategy [fl~)- J6). In Sec- 
tion [V] we will make use of these existing results to 
provide computable theoretical bounds on the achievable 
key rates. For most channel models, perfect reliability 



can only be achieved asymptotically, as the block size 
moo, and keys generated over any finite block size 
n < 00 violates the conditions of perfect reliability. To 
that end, to evaluate the reliability of the generated key 
bits over finite blocks, we introduce a weaker notion of 
security. Before we provide that definition, let us define 
the bit mismatch rate at the legitimate nodes as 

BMR = eSi(wmd 

3 nR 

for j £ {1,2}, where l(-) is the indicator function, 
which is equal to 1 when its argument is correct, and 
otherwise. 

Definition 2: We say that (e, 5)-reliable key bits are 
generated at rate R, if 

H(k j )/n = R, j €{1,2} 
BMRj < e 

/(kjjOeaCiM.CaM^J/n < (5, j e {1,2}. 

When evaluating our key generation algorithm, we pro- 
vide the associated (e, 8) pair at a given rate R. 

IV. Key Generation Algorithm 

Our proposed algorithm allow the legitimate nodes 
to generate secret key bits from their mobility patterns 
after following phases: quantization, opportunistic bea- 
con exchange, location estimation, public discussion and 
privacy amplification. In this section, we briefly explain 
each part, and then provide the complete scheme in 
Algorithm Q] 

A. Quantization 

Prior to the first stage, the nodes quantize the state 
space s = [li,l 2 ,l e ]. Quantization is required for the 
nodes to efficiently calculate the location estimates and 
store them in their buffers for use in the subsequent 
public discussion phase. Let ip(-) be a predetermined 
quantization function. Then, the legitimate nodes j € 
{1,2} can obtain quantized version of the state space 
as s A = [If, If, If], where Zf[i] = i(j{l 3 \i}, A), and 
we define |A| = max x \x — ip(x)\ as the resolution of 
quantization. In our algorithm, we consider the uniform 
quantization method, where 

ip(x) = arg min || k — x\\ 

uA o 
subject to: k = —=, u € Z ■ . 
v2 

Similarly, we assume that the eavesdropper quantizer be 
represented with parameter A'. 
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B. Opportunistic Beacon Exchange 

In this phase, the legitimate nodes exchange beacons 
to develop the common randomness which serves as 
the basis for key generation in the following steps. 
Beacons are exchanged over n subsequent slots to form 
the observation vectors oi and o 2 as outlined in Table ITT1 
Node e, on the other hand, overhears the beacons and 
obtains the observations o e . Note that at any slot i, 0\\i\, 
02[i], and o e [i], are independent of each other given s[i]. 
Therefore, when Oi[i) and 02[i] are both stochastically 
degraded versions of o e [i], i.e., there exists a density 
function / such that the condition 

f(oMs[H)= [ f(x\s[{\)f( 0j \i]\x)dx (12) 

J x—o e [i] 

holds for j € {1,2}, transmission at slot i benefits the 
eavesdropper more than it benefits the legitimate nodes. 
This is due to the fact that, since node locations are not 
independent across time, the eavesdropper can use the 
advantage obtained at slot i to obtain better estimates 
at slot i + 1, Therefore, skipping beacon transmission at 
slots when condition ( fT2l occurs will yield higher key 
rates compared to the case where a beacon is exchanged 
in every slot. 

In our opportunistic beacon exchange scheme, pro- 
vided in Algorithm [2] the decision of beacon transmis- 
sion in a slot is made by the the legitimate node that is 
more capable, i.e., the one with lower pj. This node is 
defined to be the master node, and is chosen prior to the 
opportunistic beacon exchange phase. Let 

. M _ [du[i] - d 2 e\i}cos{^ e \i])) 2 -f{d le \i}) 
* — j — FT? 

(d 2e [i] - <hS\ cosQ e [i])) 2 7 {d.2e[i}) 
d^W 2 

(di e \i]d2e[i] sm(4> e [i])) 2 'y < / > (di e [i},d2e[i}) 

B * = , r-|2 ■ 

Let pmax = max(/Oi, p%). The master node decides to 
transmit a beacon at slot i either when the condition 

P (7(di2H)/W > (A[i\ + B[i])p e \{o k [l]}\z\) < r 

(13) 

holds for some predetermined threshold r, or when no 
beacons have been transmitted in the previous c slots, 
chosen appropriately in order to avoid long droughts 
leading to the possibility for the nodes to get out of 
each other's range. The condition ([T3l is chosen such 
that the condition (fT2l holds. The derivation is provided 
in Appendix [A] If the other legitimate node receives 
a beacon during slot i, it replies back with a beacon, 
otherwise it remains silent. At the end of slot i, the nodes 
update their observations, such that if no beacons have 
been transmitted, then oj[i] = for j G {1, 2, e}. 



The probability in <fl~3T > can be efficiently approximated 
with linear complexity using Forward Algorithm as 
follows. Due to the Markov assumption on the mobility 
model, the states s A [i — 1] — > s A [i] — > s A [i + 1] form 
a Markov chain. Also, since the observations Oj[i] are 
Gaussian, with a variance depending solely on the cur- 
rent state s A [i], Oj[i] is independent of {s A [fc]}fc^i given 
s[i]. Therefore, s A [i]'s and Oj[i]'s form a hidden Markov 
chain as depicted in Figure[3] Forward Algorithm follows 
from the simple observation that for any slot i, 

/( 0j [i],..., 0j h, s a H) = J /( 0i [i],..., 0j -[*-i], 

s A {i - l])P( S A [z]| S A [* - l])/( 0j [z]| S A [z])d S A [z - 1]. 

(14) 

The term P(s A [z]|s A [i — 1]) is called state transition 
probability, and is independent on current time slot 
i, since the mobility model is stationary. The term 
f(oj [i]\s A [i]) is called emission density, which is Gaus- 
sian, as described by (HJ-®. Thus ( TT4T > gives us an it- 
erative relationship to calculate /(oj[l], . . . , Oj[i], s A [i]) 
using f(oj[l], . . . , Oj[i — l],s A [z — 1]). Iterating over 
( fT4b for n slots, we obtain f(oj, s A ). Recall that s A = 
[1 A , 1 A , Ig ], the quantized states, contains quantized ver- 
sion of all the distance and angle information in ( fl~3b , 
e.g., (d A 2 ,d A e ,4> A ). Hence, the probability in ( fl~3T > can 
be efficiently calculated. 

Note that if the mobility is i.i.d., then no advantage 
in terms of secret key rate can be obtained by using 
opportunistic beacon transmission. Still, power would 
be more efficiently utilized. In Section IVI1 we show 
that our algorithm achieves non-zero secret key rates 
for some cases that yield zero secrecy rates when a 
beacon is transmitted every time slot. We also compare 
our algorithm with the genie aided case, in which a genie 
knows the exact locations all the nodes in the field, and 
tells the nodes to skip beacon transmission at slot i when 
the condition 

7(^12 H)/CW > (A[i] +B\i})p e 

is satisfied. The genie aided case provides us an upper 
bound on the achievable key rate among algorithms that 
use this condition for beacon transmission decisions. 

~ gA[j _ 1] ~ s A[j] ^ s A[j + y ^ 

T t y 

Oj[i-l] 0j [i\ Oj[i + l] 

Fig. 3: The hidden Markov structure 
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C. Localization 

In this phase, the legitimate nodes obtain the es- 
timates if and if of the quantized location triple 
s A = [If ,lf ,lf] where 

if = argmaxP(sf \ 0j ), J € {1,2}. (15) 

J S A 

Similar to the Forward Algorithm, the terms if are 
obtained efficiently by using the Viterbi Algorithm in 
our scheme. Let 

X j (s A \i]) = 

arg max P( S A [1], • • • , s A [i\\of [1], • • • ,of [z]) 

s A [l],--- ,s A [i] J J 

denote the most likely sequence of node j based on its 
observations up to slot i. Then, Viterbi algorithm follows 
from the following relation for any i, 

f( Xj (s A [i\),of[l},---,of[i\) = 
f( Xj (s A [i-l}),of[l},--- ,of[i-l])x 
P( S A [z]| S A [z-l])/( f[z]| S A [z]). 

Iterating over n slots, the nodes j S {1,2} find if = 
arg max Xj (s a [n]} F( Xj (s A [n])\oj). 

D. Public Discussion 

In this stage, legitimate nodes 1 and 2 agree on a key 
based on their location estimates if after exchanging 
messages over the authenticated error-free public chan- 
nel. First, we explain the process for no GLI. Due to the 
lack of angle information at the legitimate nodes, keys 
are generated solely from the nodes' quantized estimates 
df of the relative distance di2, which is extracted from 
their location estimates if as follows: The term if 
can be written as if = [if, if, if], and for any i, 
df[i] = \\l A [i] — l A Since the nodes' mobility is 
not i.i.d., their locations, hence relative distances in the 
consequent slots are correlated with each other. There- 
fore, we only consider the relative change in distance, 
instead of the distance itself. First, the nodes convert 
their estimates of the relative change in distance to binary 
form as follows. Let k : Q A —> {0, l} m , where Q A is 
the set of possible quantized distance differences. The 
mapping is one to one and order preserving. For instance, 

K(df\i] - df[i - 1]) = [1 1 ... 1] if df [*] - df[i - 1] 

attains the maximum possible value, i.e., if the legitimate 
nodes move farthest apart possible from each other in 
slot i, and K{df[i] - df [i - 1]) = [0 ...0] if 
df [i] — df[i — 1] attains the minimum possible value, 
i.e., if the legitimate nodes move closest to each other 
possible in slot i. The number of digits m depends on the 
possible distance change combinations, which depends 
on the mobility model, and the choice of A. From these 



binary sequences, node j e {1,2} forms Vj G {0, l} nm , 
where 

[vj[(i — l)mi] . . . Vj [im\ — 1]] = n(df [i] — df [i — 1]). 

For perfect GLI, the legitimate nodes also make use 
of their estimates of the angle information #12, which 
provides additional bits to their message sequences Vj. 
The process is very similar to the no GLI case, hence is 
not covered here. 

Next, the nodes apply Cascade reconciliation pro- 
tocol ll27l to agree on a secret key based on their 
nm bit binary sequences v.,-. Cascade is a two-way 
public discussion protocol which exchanges amount of 
information close to the theoretical bound when Vj are 
binary symmetric sources with crossover probability up 
to 15%. Here, we provide a brief sketch of how the 
protocol applies to our scenario. The protocol operates 
over several passes. In the first pass, binary sequences 
Vj are divided into ni blocks Uj o[l] . . . , u^ofni] of size 
mi such that mmi = nm, and 

Uj,oW = [vj[(i - l)mi] ■ • ■ Vj[imi - 1]] 

and 

Uf,o = [u ji i[l]---u i)1 [m]]. 

Node 1, the master node, calculates parity bits C\ [i] from 
each block Ui,o[«] as 

d\i] = v x [(i - l)mi] © • • ■ © ui[oth - 1], 

and communicates [Ci[l] • • • Ci[n]] to node 2 over the 
public channel. Node 2 similarly calculates the parity 
bits from U2 i o[i]- If tne parity in block i does not 
match, i.e., C\[i] 7^ then it indicates that there are 

odd number of errors in block i. In that case, a recursive 
protocol referred to in l27l as BINARY is executed, 
which is essentially recursively dividing block i to sub- 
blocks and comparing the parities of the sub-blocks until 
a bit in error is found. When all the blocks 1 . . . n\ are 
compared, they all contain even number of errors, and 
the first pass is over. In the subsequent passes p > 1, the 
sequences u JiP _i are shuffled according to some random 
permutation function g such that 

u i,P - .9( u j,p-i), 

and the parity exchange process on each block u J p [i], 
i € {l...n p } is similarly repeated. Note that, when 
an error is found and corrected in p'th pass, the blocks 
containing that corrected bit in the p — 1 passes contain 
odd number of errors. Therefore, the parity exchange 
process is repeated on the smallest sub-block of the 
among those blocks. This process is repeated for P 
passes, where P depends on the bit mismatch rate of 
the initial sequences Vj. At the end of the protocol, T 
bits is exchanged each way between the legitimate nodes, 
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where node j has sent bits [Cj[l] ■ ■ ■ Cj[T]}. Due to the 
interactive nature of the protocol, the number T depends 
on the initial bit mismatch rate between the sequences 
vi and V2, and the number of passes P. 

In |[27l . it is suggested that the block size m p in pass 
p is chosen such that m p = 2m p _ 1 for p > 1, and m,\ is 
chosen such that P(ui o[i] 7^ U2,o[i]) = 0.7. Probability 
of error after the public discussion, P(ui i p ^ u 2j p), 
decays exponentially with number of passes P, which is 
chosen large enough such that the reliability constraint 
in Definition |2] is satisfied. For simplicity, we drop the 
number of iterations for the key sequences generated at 
the end of Cascade reconciliation protocol and denote 
the resulting key sequences with: Uj = Uj.p. 

E. Privacy amplification 

After the public discussion case, the legitimate nodes 
1 and 2 end up with keys Ui and 112, respectively. Mean- 
while, the eavesdropper also obtains a key sequence u e 
that is correlated with the legitimate nodes' keys due 
to two reasons: The eavesdropper's observations o e are 
correlated with the legitimate nodes' observations 01, 
02, the parity bits exchanged during cascade protocol in 
public discussion phase reveals some information about 
the keys Ui and 112 to the eavesdropper. In the privacy 
amplification phase, the legitimate nodes will map their 
keys into a shorter sequence, ki and It2, of key bits in 
such a way that the eavesdropper has no information 
on them. Privacy amplification is typically done by hash 
functions that have approximate universality properties 
l28l . Let Hhash denote the used hash function. In our 
algorithm, we use the SHA-256 l26l hash function for 
H hash , i.e., ki = Hhash(ui), and k 2 = H hash (u 2 ), 
both of size nR. 

Now, we explain the choice of rate R. We cannot 
explicitly find the supremum of rates R for which our key 
generation algorithm is perfectly reliable according to 
Definition!!] since calculation of the equivocation rate at 
the eavesdropper, given in equation (fTTT i is not feasible. 
However, we assume that the eavesdropper follows a 
strategy that is better than the optimal strategy it can per- 
form, as follows. In Localization phase, we assume that 
the eavesdropper also uses the Viterbi Algorithm to ob- 
tain the estimate of the locations, and converts it to a 
bit sequence v e of size nm. The public discussion phase 
consists of two stages. In the first stage, node j € {1,2} 
obtains based on the observations Oj and obtains the 
bit sequence Vj. In the second stage, node 1 sends parity 
bits [Ci [1] , • • • , Ci [T]} and node 2 feeds back parity bits 
[C2[l],-'' jC^PI] as acknowledgments in the cascade 
algorithm and the nodes obtain bit sequences Ui and 112, 
both of size nm, where Ui = 112 with high probability. 
Note that, this approach is suboptimal compared to the 
soft decoding scheme in which the bit sequence u 2 



is decoded directly based on the observations 02 and 
the parity bits. Therefore, in our security analysis, we 
assume that the eavesdropper does not follow the sub- 
optimal approach. Instead, we make the highly optimistic 
assumption for the eavesdropper that it corrects T bits 
that was in error; equal to the number of parity bits 
exchanged each way during cascade protocol. 

In the privacy amplification step, the rate of hashing 
R is chosen as follows. Due to the privacy amplification 
result in l28l . it is sufficient to choose the rate R less 
than the equivocation rate (prior to privacy amplification) 
at the eavesdropper to avoid an information leakage to 
the eavesdropper at a positive rate. Due to quantization 
applied at the eavesdropper, the equivocation rate of the 
bit sequence Ui becomes 

(ui|§f ,{Ci[i],C 2 M}f =1 ) >ff( Ul |u e )-T, (16) 

where ( TToT ) follows from the fact that public broadcast 
of the messages {Ci[i], C2[t]}|Li can at most reveal T 
bits from ui. Therefore, it suffices to choose the rate R 
as| 

R = #(ui|u e ) —T — 6, 

to satisfy the security constraint in Definition |2] In the 
privacy amplification stage of our scheme, we choose T 
large enough to achieve a given constraint BMRj < e, 
but not too large and make the key rate R too small. 
In Section [V] we derive fundamental limits on the 
achievable key rate, subject to perfect reliability and 
compare the performance of our algorithm with the 
bounds in Section [VT1 

Finally, for the randomness of the generated keys, we 
use the NIST test suite, and perform the randomness 
tests of the generated key sequence ki and k 2 . 

V. Theoretical Performance Limits 

In this section, we provide the theoretical bounds 
on the achievable key rate with perfect reliability. To 
evaluate these bounds, we assume an idealized system 
by ignoring the issues associated with quantization, 
cascade reconciliation protocol, and SHA-based privacy 
amplification. Thus, these bounds are valid for any key 
generation scheme. 

A. Bounds on the Achievable Key Rate 

In this section, we establish upper and lower bounds 
on the key bits achievable through public discussion, 
with and without GLI. 

3 Note that, for n ;§> 1, _ff(ui|u e ) can be approximately evaluated 
as follows. Let u e be formed by passing ui through a binary symmet- 
ric channel, with crossover probability BMR e , identical to the bit mis- 
match rate of the eavesdropper, i.e., BMR e = Si=i ^ 
Then, ff(ui|u e ) « nm(l - BSC(BMR e )), where BSC(BMR e ) 
denotes the capacity of a binary symmetric channel with crossover 
probability of BMR e . 
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Algorithm 1 Key Generation From Localization 
Step 0: Quantization 

i?[i\<-1>(!j[i\) 

«f[i]^-[^[i],^[i],ew] 

Step 1: Opportunistic Beacon Exchange : Forward 
Algorithm 

(oi,o 2 ,o e ) ^BEACON 

Step 2: Localization : Viterbi Algorithm 

for node j g {1,2} do 
for slot i = 1 : n do 



for 



g {1...M} 6 do 
A7} 6 do 



for s A [i] g {1 



if/(o i [l],...,o J -[i],Xi(s A [i-l]) ) s A [i])> 
/( 0j [l],..., 0j [z],X,(s A W))then 

x^DMx^-i]),^]) 

end if 
end for 
end for 
end for 

sf[n] <- argmax Xj(;s A W) f(xj{s A [n}), of) 
end for 

Step 3: Public Discussion: Cascade Protocol 

for slot i = 1 : n do 

Vj [q^ K (df[i\-df[i-i}) 

end for 

(ui , u 2 , u e ) i- CASCADE(vi , v 2 , v e ) 
Step 4: Privacy Amplification 

<- H hash (uj), j g {1,2} 



Theorem 1: A lower bound Rl, and an upper bound 
Ru on the perfectly-reliable key rate achievable through 
public discussion are 

R L =m&x\ lim - [7(oi; o 2 ) - 7(oi; o e )] + , 

I n— >oo TL 



lim - [7(o 2 ;oi) -7(o 2 ;o e )]" 

n— >oo 77, 



(17) 



and 



77(7= lim -min{7(o 1 ;o 2 ),7(o 1 ;o 2 |o e )} (18) 

respectively, where the observations o 1; o 2 and o e are 
as given in Table [II] for different possibilities of GLI. 
The theorem follows^ from Theorem 4 in lfl6l . which 
generalizes Maurer's results on secret key generation 
through public discussion JTJ, to non-i.i.d. settings. Note 
that tighter bounds exist in the literature [j2), ||3|, however 

4 Theorem 4 of [16| provide general upper and lower bounds 
including the case where the source processes are not ergodic. In our 
system model, 01, 02 and o e are ergodic processes, hence they are 
information stable, therefore these lower and upper bounds reduce to 
(T7J and {18), respectively fT51 . 



Algorithm 2 Opportunistic Beacon Exchange 

BEACON: 

j Master Node 
CTR^ 

P(sf [0]) «- 1/A7 6 , Vsf [0] g {1. ..MY 
for slot i = 1 : n do 

for s A [i -1] g {1...A7} 6 do 
for s A [?:] g {1...M} 6 do 

x 1 ^l( 7 (d 12 [z})> A{z}+B^\s A [i}) 
x 2 ^ f(o j [l},...,o J [i-lls A [i-l}) 
x 3 ^F(s A [i\\s A [i-l}) 
C <- C + a^ia;2a;3 
end for 
end for 

if C < t or CTR > c then 
NODE 1 TX BEACON 
NODE 2 TX BEACON 

Oj\i] <- (d,-[i],A) 
CTR ^ 
else 

NODE 1 SILENT 
NODE 2 SILENT 

CTR <r- CTR+1 
end if 
end for 



we use the above bounds, since they provide much 
clearer insights into our systems due to their simplicity. 

Note that for the special case where node locations 
(h[i\, h[i), M'D are i-i-d-n it is clear that the distances 
{d 12 [i],d le [{\,d 2 e[i\), angles (<£i 2 [£], (j>i e [i\, <j>2e[i]), and 
observations (oi[i],o 2 [i],o e [i]) are also i.i.d.. Hence we 
can safely drop the index i, and denote the joint prob- 
ability density function of observations as f(oi,o 2 ,o e ). 
Therefore, the conditioning on the past and future ob- 
servations in Rl and Rjj disappear, and the lower and 
upper bound expressions reduce to 

R L =max y [7(oi;o 2 ) - I(o 1 ;o e )} + , 

[7( 0l ;o 2 )-7( 02 ; 0e )] + ^ (19) 

R v =min(7(oi;o 2 ),7(oi;o 2 |o e )) , (20) 
respectively. 

B. Beacon Power Asymptotics 

In this part, we analyze the beacon power asymptotics 
of the system. We show that, if the eavesdropper does 
not observe the angle, i.e., <f> e = 0, then Rl increases 
unboundedly with the beacon power P, which indicates 
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that arbitrarily large secret key rates can be obtained. 
However, when eavesdropper observes the angle infor- 
mation, then Ru remains bounded, which indicates that 
the advantage gained by increasing beacon power is 
rather limited. Hence, we show a phase-transition phe- 
nomenon with the angle observations. Even with a highly 
noisy angle observation, as long as I(<fi e ; <fi e ) > 0, the 
key rate does not grow unboundedly with the beacon 
power. To clearly illustrate our insights, we present our 
results for the no GLI scenario. However, the same 
conclusion holds for the perfect GLI case as well. 

Theorem 2: When the eavesdropper obtains angle in- 
formation, i.e., I(4> e ; 4> e ) > 0, 



lim Ru < oo. 

P^oo 



(21) 



The proof is in Appendix [B] where we show that 
lmip^oo Ru < 77, where 



n 



ilog |2ttE 



-7(^12) 



+ (Ad le d 2e + 64(di e d 2e ) 2 hcl>(die,d2e) 

+ 8(dle + d2e)dled 2 e{\Jl{dle) 
+ V l(d2e)) \J J<p(dle,d2e) 



64(d 



le 



d2e) 2 (l(d le ) 



■7(d 2e )) 



1 

- -E 
2 



log (27rpi7(di 2 )) 



(22) 



The parameter 77 remains finite as long as the distances 
take on values in some bounded range [d m in, rfmax] with 
probability 1. Therefore, the secret key rate remains 
bounded. 

Theorem 3: When the eavesdropper does not obtain 
any angle information, i.e., I((j) e ; <fi e ) = 0, 

Rl ,. Ru 



lim 



= lim 



P^™ \ log(P) P^oo I log(P) 
= 1. 

The proof is provided in Appendix[B] Theorem[3]implies 
that, without the angle observation at the eavesdropper, 
an arbitrarily large key rate can be achieved with suf- 
ficiently large beacon power P. However, the key rate 
increases with log(P), which means that increasing the 
beacon power would provide diminishing returns. Also, 
note that, apart from the beacon power, there are other 
practical factors limiting the key rate, such as biased 
observations. We study such limitations in Appendix ICl 

VI. Numerical Evaluations 

In this section, we evaluate the key rate performance 
of our key generation algorithm, and compare with 



the theoretical bounds on the secret key rates using 
Monte Carlo simulations. We also study the theoretical 
performance gain of the opportunistic beacon exchange 
strategy used in part of our algorithm. First, we briefly 
explain the setup, then provide the results. 

Setup: An (M x M) discrete 2-D grid simulates a 
city with M blocks, that covers a square field of area 
A 2 , such that for any j e {1,2, e}, i £ {1, ...,n}, 
= [x »]€{£>••-. MA} x{A..., MA}. Node 
mobilities are Markov, and characterized by parameter 
B, where 



{lj [i] = [xy]\ lj 



W y'\ 



1 ;f 

(B+TF 




l«'l<4f 

\y-y'\<^ 

otherwise 



For no GLI, the nodes' observations are as defined in 
(!]!-©> where we assume 7(d) = 0.1 + d 2 , and 

l4>{dle,d 2 e) = 7T - 



1.1 



(die T ^2e) 

such that both parameters are strictly increasing func- 
tions of the distances^ For perfect GLI, the angle 
observations of the nodes are as defined in (01 and ©, 
where 

7<f,{dje) = 7T - * 2 

1.1 + (dje) 

for j <G {1,2}. The distance observations are the same 
as in no GLI case. For both cases, the node capability 
parameters p\ = P2 = Pe = 1 unless otherwise 
stated. The theoretical key rates in Section [V] converge 
as n goes to infinity, therefore they are calculated for 
large enough n, using the forward algorithm procedure 
described Section HVl 

Results: Due to computational limitation^, we con- 
sider examples in which M < 11, and B < 3. Note 
that this choice limits the maximum achievable secret 
key rate. For instance, for the choice of B = 1, due to 
the limited mobility of the nodes, there are 13 different 
possible distance combinations. Consequently, a key rate 
of log 13 is an absolute upper bound on the key rate for 
no GLI even in the case when the eavesdropper does not 
obtain any distance or angle observation. Note that, the 
actual key rate can be much lower than log 13 due to 
the eavesdropper's observations. In the light of this, we 

5 Since </> e £ [0, 7r], the angle observation error variance cannot 
diverge with distance, and in our model, the variance is chosen to 
be upper bounded by 7r/l.l. To avoid zero error variances at zero 
distance, we introduce a 0.1 offset to numerator and denominator of 
7 and 70, respectively. 

6 Although the forward algorithm makes the calculation of the 
bounds possible, since the complexity of forward algorithm scales 
with the square of the available states, which is equal to M e , it is 
not computationally feasible to calculate the bounds for large values 
of M, B. 
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would like to point out that, the main objective of our 
initial set of simulations is to provide insights into the 
relationships between the basic parameters of the system, 
to compare the performance of the opportunistic key 
generation scheme with the maximum achievable key 
rate, and to illustrate the tradeoffs involved. In reality, 
the grid sizes will be much larger and the mobility 
pattern typically allows for a richer variety (and hence 
a larger entropy rate), depending on the speed and the 
maneuvering capabilities of the nodes. Note that, our 
key rate plots are as a function of normalized beacon 
power P/(Tq, where a 2 denotes the variance of distance 
observations dj[i] of legitimate nodes at unit distance. 

First, we provide the performance results of our key 
generation algorithm. In Figure |H we plot the key rate 
achieved with our algorithm with respect to the normal- 
ized beacon power P/cr 2 , for M = 5, A = 5, and B = 1. 
We show that, even in this grid with a small number of 
possible locations, we can generate (e, r5)-reliable key 
bits comparable with the theoretical capacity bounds 
provided in Section [V] for e = S = 10 -3 . Note that 
the key rate starts to decrease at a certain beacon power, 
beyond which the rate of information accumulation at the 
eavesdropper exceeds that at the legitimate nodes. Also, 
we emphasize that the lower bound and the upper bound 
provided in Figure [4] are analytically proven bounds on 
key capacity, where the lower bound is achieved by 
using random coding arguments which are not feasible 
to implement due to computational complexity. Although 
our algorithm performs worse than the theoretical lower 
bound, it is implemented using tools that are feasible to 
use, such as viterbi algorithm, cascade algorithm, etc. In 
Table UTIl we provide the results of the NIST randomness 
tests. Here, a value greater than 0.01 is considered as a 
pass 



Test type 


result 


Frequency 


0.534146 


BlockFrequency 


0.911413 


CumulativeSums 


0.534146 


Rank 


0.066882 


FFT 


0.350485 


LinearComplexity 


0.122325 



TABLE III: Randomness test results for the key genera- 
tion algorithm 



Then, we analyze the effect of the different grid 
size, field area and GLI on the theoretical key rates. In 
Figures [5] and [6] we plot the bounds on the achievable 
key rate with respect to the normalized beacon power 
P/ctq for different grid size M for no GLI and perfect 
GLI cases, respectively. We assumed a constant ratio 
of field size and grid size, A/M = 1, and considered 
B = 1. We can see that, there is a diminishing return on 
the increased power levels for the achievable key rate. 
Furthermore, we can see that increasing the field area 
A 2 has a negative impact on the key rate despite the 
increase in M, which is due to the fact that the common 
information of the legitimate nodes decreases as a result 
of increase in their observation error variance. Next, in 
Figures Q and [8] we plot the bounds with respect to 
beacon power P, for different step size B = 1 for no 
GLI and perfect GLI cases, respectively. We assumed 
M = 5 for the no GLI case, and M = 7 for perfect GLI 
case, and in both cases, the ratio of field size and grid 
size is constant, such that A/M = 1. We can clearly see 
the positive effect of the increased step size on the secret 
key rate. This is due to the increase in different distance 
combinations that are possible. 

Next, for no GLI, we evaluate the theoretical per- 
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Fig. 4: Comparison of theoretical key capacity limits and 
key generation algorithm vs normalized beacon power 
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Fig. 5: Upper and lower bounds for no GLI vs nor- 
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Fig. 8: Upper and lower bounds for perfect GLI vs 
normalized beacon power P/<Jq, M = A = 7, for 
different B 
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Fig. 7: Upper and lower bounds for no GLI vs normal- 
ized beacon power P/<Jq, M = A = 5, for different 
B 

formance of opportunistic beacon exchange scheme as 
well as the impact of the eavesdropper mobility scheme, 
both described in Section [IV] First, we compare the 
performance of our proposed opportunistic beacon ex- 
change scheme with the non-opportunistic counterpart, 
which transmits out beacons in each time slot. We show 
that, even under a pessimistic scenario for the legitimate 
nodes, non-zero secret key rates can be achieved by our 
opportunistic scheme, which would not be possible with 
the non-opportunistic case: We assume that node e is 
more capable such that p± = p2 = 1 and p e = 0.6, which 
can model the case where node e is equipped with more 
antennas compared to the legitimate nodes. Furthermore, 
node e stays fixed at the center of the M x M grid, for 
M = 7 and A = 5 and B = 1. Since the observation 



noise variance is an increasing function of the node 
distances, this also gives node e a geographic advantage 
over the legitimate nodes 1 and 2. We can see from 
Figure [9] that secret key rate decays to with the non- 
opportunistic scheme. On the other hand, non-zero secret 
key rates can be achieved with our opportunistic strategy 
outlined in Section llVl for parameters t = 0.5 and c = 4. 
On the same figure, we also plot the achievable key 
rates for the genie-aided scheme, which has the reach 
to the perfect side information on whether the legitimate 
nodes have a geographical advantage or not at any 
given point in time. With such side information, the key 
rate is roughly doubled compared to our opportunistic 
scheme. Note that our algorithm obtains information on 
the presence of a geographical advantage, based solely 
on the beacon observations. One of the issues is that, 
when the two legitimate nodes skip beacon transmis- 
sions, their information on each other's location becomes 
more degraded, hence they cannot predict whether they 
still keep the geographic advantage compared to the 
eavesdropper. Despite the fact that our algorithm skips 
on the average 69% of the beacon transmissions due to a 
predicted geographic disadvantage, it is remarkable that 
roughly half the key rate is achievable with our scheme 
compared to the case with the genie-aided perfect side 
information. 

Finally, we analyze the effect of eavesdropper mobility 
on the achievable key rate. In Figure [10] for M = 7, 
^4 = 5 and B = 1, we plot the secret key rate 
bounds versus beacon power for the cases where the 
eavesdropper i) follows the random mobility pattern 
described in the setup with parameter B = 1, ii) stays at 
the origin, and iii) follows the man in the middle strategy 
described in Section IIII-CI i.e., moves to the mid point 
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of its location estimates of nodes 1 and 2. We can see 
that, compared to following a random mobility pattern, 
the eavesdropper can reduce the achievable secret key 
rate significantly by following this strategy. Also, it is 
notable that the eavesdropper can significantly reduce the 
key rate by simply staying static at a certain favorable 
location, rather than moving randomly. Note that, in 
practice this may not be feasible for the eavesdropper, 
since, by staying put, it will lose connection completely 
with the legitimate nodes in a large region. 
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Fig. 9: Opportunistic beacon exchange, no GL1 
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Fig. 10: Effect of eavesdropper mobility on the key rate 



VII. Conclusion 

In this paper, we developed a four stage algorithm 
that generates keys based on the relative localization 
information between legitimate nodes in mobile wireless 
networks. The first stag In the first stage, legitimate 



nodes generate relative localization information by op- 
portunistically exchanging beacons whenever the legiti- 
mate nodes sense a geographic advantage compared to 
the eavesdropper. In the second stage, the nodes perform 
localization, and in the third stage, the nodes' relative 
distance estimates are converted to a binary sequence, 
out of which the nodes agree on some initial key bits 
by public discussion. Finally, privacy amplification is 
performed on the key bits to obtain the final key with a 
low bit mismatch rate at the legitimate nodes as well as 
a low information leakage rate to the eavesdropper. We 
also studied the information theoretic limits of secret key 
generation, and characterized lower and upper bounds 
of key rates utilizing results from the source model of 
secrecy, for the cases in which the nodes are/are not 
capable of observing their global locations. Furthermore, 
we studied the beacon power asymptotics, and showed 
that when the eavesdropper cannot observe the angle 
information, the secret key rate grows unboundedly, 
whereas with an angle observation at eavesdropper, key 
rate remains bounded. We showed that a secret key 
rate, identical to half of that achievable with perfect 
side information on whether the legitimate nodes have 
a geographical advantage can be obtained with our 
opportunistic strategy. This is highly significant, since 
we show that it is not possible to achieve a non-zero key 
rate with a non-opportunistic strategy. Then, we studied 
mobility strategies for the eavesdropper to minimize the 
secret key rate. Our current investigations are mainly 
focused on 1) common secret key generation among 
multiple nodes in a wireless network, 2) application to 
wideband localization, and 3) practical applications on 
high beacon SNR. 

Appendix A 
On opportunistic beacon exchange 

We do not directly use ( fT2l for beacon transmission 
decisions due to certain challenges. Here, we address 
them, and justify why we use ( PT31 instead. The first issue 
is that it is difficult to verify Condition (fT2l . To see 
whether there exists a valid probability density function 
/ that satisfies dT2t . we can pose the problem as that of 
calculus of variations: 



/; = mm 

/ 



/(di[i]|dia[i])- 



/(s|d l2 [*1)/(di[i]|a!)da; 

I X=(di e [i],(he[i],$e[i]) 

subject to : J f(u)du = 1. 

If /i = 0, then the legitimate nodes' observa- 
tions are stochastically degraded version of the eaves- 
dropper's observations. However, due to the fact 
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that there may exist no closed form expression for 
/(die [i] j ^2e[*]) <^e[i] 1^12 [i])> this problem can be highly 
complex. Instead, in our algorithm, the legitimate nodes 
make their decisions based on an approximate version of 
Sl7\ at the expense of some loss in the key rate. Define 
dJi] as 



cL \i] 



d le [i} 2 + d 2e [i\ 



2d le [i}d 2 e[i\cos(4> e [i}) , 
(23) 



which corresponds to the cosine law estimate of d 12 [i] of 
the eavesdropper. Through a sequence of approximations 
on d e [i] as described in Appendix I A- Al we end up with 



d* e [i] = d 12 [i] + w e [i], 



(24) 



where u> e [i]~./V( 0, 



A[{\ = 



Pe(A[i]+B[i\) 



such that 



(d le [i] - d 2e [i] cos(cf) e [i\)) 2 j(d le [i\) 
d^W 2 + 
(d 2e [i) - die[i] cos(4> e [i})) 2 ~f(d 2e [i}) 



is the uncertainty that comes from the distance observa- 
tion errors, and 



B\i] = 



(di e H d 2e [i] sin(0 e [i] )) 2 7^ (d le [i] , d 2e [i] ) 
d 12 [i} 2 



is the uncertainty that comes from the angle estimate 
error. Note that the idea behind the described approxima- 
tion is linearization of d e [i] and hence the approximation 
becomes more and more accurate as the beacon power 
increases (i.e., in the high signal to noise ratio regime). 

In our algorithm, the legitimate nodes use the 
term d*[i] for beacon transmission decisions. Clearly, 
di 2 [i) — > (di e [i],d 2e [i],(j) e [i]) — > d*[i] forms a Markov 
chain. Consequently, when di [i] and d 2 [i] are stochasti- 
cally degraded versions of d*[i], they are also stochasti- 
cally degraded versions of the eavesdropper observations 
(di e [z], d2e[*]) 0e[*])> hence the condition (fT2l is satis- 
fied. Since the legitimate nodes' observations follow the 
distributions 

j{pidi 2 \i}) 
P 

7(P2^12H) 
P 



the condition 

*W7(dia[t]) > pe(A[i] + B[i]) (25) 



di[i]~AT( dia[«] 
d 2 [i)~N(d 12 [i\ 



would be sufficient to verify that the actual node mea- 
surement is more degraded than the eavesdropper mea- 
surement Note that the legitimate nodes cannot make 
use of d25l l for beacon transmission decisions directly, 
since they only have the statistics of the eavesdropper 
location, and they do not know the parameters A[i], 
B[i] and di 2 [i] exactly. However, using the statistical 
knowledge, they can calculate the probability of event 
( 1251 ). conditioned on their observations, which is ( fl~3b . 
Therefore, $13[ is used as a basis for beacon transmission 
decisions. 



A. Linear Approximation for d e 

In this part, we explain how we obtain d* [i] from d e [i] 
via a sequence of linear approximations. In what follows, 
we drop the time index [i] for simplicity. 



(die + w le ) 2 + (d 2e + w 2e ) 2 - 

2(dl e + Wi e )(d 2e + W 2e ) COs(4> e + 



0.5 



l 2e 



2d le w le + 2d 2e w 2e 



2d\ e d 2e cos(4> e + UtyJ - 2di e w 2e cos(0 e + tftyj 

- +\ 0.5 

2d 2e wi e cos(c/) e + J I (26) 



d\ 2 + 2di e d 2e sin.(<j> e )w^ e - 



2w le (d le - d 2e cos(j) e )+ 



+ \ 0.5 



2w 2e (d 2e - di e COS(j)e) 

a dl2 + ~7T \died 2e sin(^ e )to^ e 



Wle (die - d 2e COS0 e ) + W 2e (d 2e - d le COS ( 
= di2 + w x , 



(27) 



(28) 
(29) 



follows from omitting the higher order 



2w\eW 2 e C0S( 



Wfe)), since 



where 
terms (w\ e 

their variances scale with O(-pj-); (|27| | follows from the 
approximation 

cos(4>e +w<j ) J = cos((/>e) cos(w0 e ) - sin(^ e ) sin(uty e ) 
s» cos(^ e ) - w t j )i! sin((j6 e ), 

which becomes accurate as w,p c \ 0; and (|28| | follows 
from the linear approximation yl + x f=s 1 + | for x <C 
1, which is accurate for high signal to noise ratio, i.e., 
w</> e ,Wi e , an d w 2e are all small (close to 0) with high 

7 Note however that converse is not true since dg [i] is not a sufficient 
statistic of (di e [i], d,2 e [i], 4>e[i])- 
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probability. Note that, the overall noise term follows the 
distribution w x ~N (o, Pe( p +B) ) . 

Appendix B 
Proofs of Theorems in Section TV-BI 

A. Proof of Theorem [2] 

We first provide several lemmas that will be useful 
when proving the theorem. 

Lemma 1: Let x and y be random variables. Then, 

Yar(x + y) < 2Yar(x) + 2Yar(y). (30) 

If x and y are independent, then 

Yar(x + y) = Var(x) + Yar(y). (31) 

Proof: When x and y are not independent, 

Yar(x + y) = Yar(x) + Yar(y) + 2<Cov{x 1 y) 



< Yar(x) + Yar(y) + 2 ^Yar(x)Yar(y) 
<2Yar(x) +2Yar{y). (32) 

where ( 1321 follows from the fact that Yar(x)+Yar(y) > 
2y / Yar(x)Yar(y). When x and y are independent, 
Cov(x, y) = 0, implying the result. ■ 
Lemma 2: Let x be a random variable such that 



E[x] > fi, where n > — 1. Let a 



. Then, 



Yar(y/[1 + x)+) < Yar{ax). 

Proof: Assume E[x] = //, where /i' > /i. Let a' = 
^SZ. Let us define = v /[I+x]+, and / 2 (x) = 

a'(l + x). Note that, 



Var(V[i + x]+) =Var(/i(a;)) 

<E[(A(x)-E[f 2 (x)}) 2 ] 

since the centralized second moment is minimized 
around the mean. Also, 

Yar(ax) > Var(a'x) 
= Var(/ 2 (x)) 

since // > \i, and a' < a. Therefore, it suffices to show 
that Vx, 



|/i(x)-E[/ 2 (x)]| < |/ 2 (x)-E[/ 2 (x)]| 



|/ 2 (x) - VT+7I- 



(33) 
(34) 



holds. 

i) First note that, 



/ 1 ( M ') = / 2 ( M ') = Vi + M 7 , 

Therefore, the condition (l34l i is satisfied for x = jj! . 
ii) For x > fx', 

fx{x)<h{fx')+f' 1 {fi'){x-fx') (35) 
< v/l + fi' + a(x - //) 
= / 2 W 



where f[(fJ,') is the first derivative of /i(x) at point 
x = fi'. d35l > follows from the fact that /i(x) is a strictly 
concave function in the interval [—1 oo). Therefore, 
condition d34l l is satisfied for x > fx'. 

iii) Combining the facts that /i(x) is a strictly concave 
function of x in the interval [—1 oo); / 2 (x) is linear; 

= M -l); and /i^i') = / 2 (//), we can see 
that VI + M' > AC^) > /afc) when -1 < a; < //. 
Therefore, condition ( f34b is satisfied for — 1 < x < //. 

iv) When a; < — 1, /i(x) = and / 2 (x) < 0, therefore, 
condition d34l i is satisfied. This concludes the proof. ■ 

Lemma 3: Let x, y be random variables. Then, 

Yar (e 1 - + x)+ \y ) < E (E[ |x| | j/]) 



fVoq/: Note that 



Var HE 
< E 



i-v/(i + ^) + |y]) 

E [l — y/(l + x)- 





2' 


\y 





Since for any x, |1 — + x)+| < |x|, 

<E[ \x\ | y] 



E 



+ \y 



is satisfied for any y, which completes the proof. ■ 
Now, we can proceed with the proof of the theo- 
rem. Assume without loss of generality that p m ; n = 
min(pi,p 2 ) = p\. When <j> e ^ 0, we can obtain an 
upper bound on the secret key rate as follows. 

R v = lim -l(di;d 2 |die,d 2e ,0 e ) 

< lim -(Mdild^dae.^J-Mdildia)) (36) 

n— )-oc ft 

l " / 

< lim -y^ \h(di[i]\di e [i] ) d2e[i] ) $e[i])- 

n— >oo rr ' * \ 



(37) 



where ( |36l ) follows from the fact that di — > di 2 — > 
(d 2 , di e , d 2e , <p e ) forms a Markov chain, and d37b fol- 
lows from the fact that all of the random variables 
<ii[i],<ii e [i],<i 2e Jz],(/> e [i] have a stationary distribution, 
denoted as di,di e ,d,2e and cf> e , respectively. The second 
term in d37l i can be directly found as 



fc(di[i]-di 2 [*]|di 2 [t]) 

=h(dl |die, die, 0e) ~ ~ ^12^12) 



- di 2 |di 2 ) = ^E 



log 



7(^12)^1 
p 



(38) 



from the definition of d\ [i] . Now, we bound the first term 
in ( f37T >. Let us define 



4e 



2d\ e d,2e cos( 
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Then, 



h(di\d le ,d 2e> 4> e ) < h(d 1 \d e ) 
< h(di — d e 



(39) 



Note that for a given variance, Gaussian distribution 
maximizes the entropy. Therefore, the entropy of a 
Gaussian random variable that has a variance identical 
to that of di — d e will be an upper bound for (|39l . We 
proceed as follows. 

Var(di - d e ) =E[Var(di - d e \di 2 , d\ e , (fee)] 

+ War(E[di - d e \d 12 , di e , d 2e ] ) , 

(40) 

where J40l i follows from the fact that for any dependent 
random variables x and y, Yar(x) = E[Yar(x\y)} + 
Yar(E[x\y}). We now find an upper bound on the first 
term of (HD1 . Note that, 

Var(di - d e \di 2 ,di e , d 2e ) 
= Yar(dx\di 2 )+Yar(d e \d 12 ,dx e ,d 2e ) (41) 

due to Lemma Q] since d\ — > {d\ 2 , d\ e , d 2e ) — > 
(di e , d 2e , <t>e) de forms a Markov chain, and the fact 
that di is independent of d\ e ,d 2e given di 2 . The first 
term in ( f4Tb is equal to 



Yar(d!\d 12 ) = Yar( Wl \d 12 ) 
_ l{d\ 2 )pi 



(42) 



We bound the second term in (f4~TT > as follows. Let us 
define k as 



K = ^2(di e - d 2e COs((j> e ))wi e ^ 

+ W 2e 2 + 2(d 2e - di e COs(4> e ))w 2e 
+ 2di e d 2e (cOs((f)e) ~ COs(^ e )) 



- 2wi e W 2e COs((f)e) 

Then, 

Yar{d e \d 12 ,d le ,d 2e ) 



Yar 



die + ^e + %(die ~ d 2e COS (f> e )wi e + 



2(d 2e — die COS(f>e)w 2 e — 2dl e d 2e COStfie + Wi 

+ \ 0.5 

W 2e 2 — 2wi e W 2e COS 



< cP 12 Var(y/[l + K] + ), 



di 2 ,die,d 2e } (43) 
(44) 



where d43l follows due to the definitions of die, d 2e and 
4> e - (l44b follows due to definition of k, and the cosine 



law d\ 2 = d\ e + d 2e — 2died 2e cos((f>e). Now we will 
apply Lemma [2] to bound d44b . First, note that 



E[k] = -2-E 

"12 
1 

> 



w\ e + w\e — 2di e d 2e (cOS 4> e ~ COS0 e ) 



Pd 2 

ra l2 



E 



^"12 



W2 e - 2died 2e \w < j )<! 



j(dle) +j{d 2e ) 



2d ie d 2 



l2P lrp (die,d 2e ) 
TtPe 



(45) 



where (|45l > follows from the fact that since is zero 
mean Gaussian, \w$ e | follows a Half-normal distribution 

with Eflu^J) = v / 2 ^ (d ^ 2e)Pe ". We can choose P : 
such that for any beacon power P > Pi, E[.t] > 
Let = 
obtain 



■§, and a 



4' 



2. Due to Lemma [2] we 



d 2 12 Yar(y/[l + k} + ) < d\ 2 Yar( an) 
4a 2 / 

-~jT~ \^ar(2(die - d 2e cos(0 e ))f«ie) 

+ Yar(2(d 2e - d ie cos(<j> e ))w 2e ) 
+ Yar(2died 2e (coa((j)e) - cos($ e ))) 
+ Yar(2wi e w 2 e cos(</) e )) 

+ Yar{w 2 le ) + Yar{wle) 

16/9 e 



(46) 



<E 



Pd\ 2 



4(di e + d 2e )'(7(rfi e )+7(rf2 e )) (47) 



(48) 



+ 4(di e d 2e ) J,p(die,d 2 e) + O ( 



where d46b follows from applying Lemma Q] to Yar(n) 
twice, and d48l > follows from the fact that 

Yar(2(d ie - d je cos(0 e ))w ie ) < Yar(2(d ie + d je )wi e ) 

for i, j £ {1, 2}, and 

Var(2died 2 e(cos(</> e ) - cos(0 e ))) 

= Yar(2di e d 2e [cos(<p e ) - cos(0 e + w^)) 
< Yar(2di e d 2e 'W^). 

Now, we find an upper bound for the second term of 
d40b as follows. 



Yar(E[di - d e \di 2 , di e , d 2e ] ) 
= Yar ( di 2 E 



1 - 



1 + k) \di 2 ,di e ,d 2e 



< E 

< E 



d\ 2 (E[|x| \di 2 ,die,d 2e \) 
1 



(49) 
(50) 



d\ 2 



E[2(dl e + G« 2e )Oi e | + |u) 2e |) + lU? e + W 



2c 
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+ 2d le d 2e \w (j>t! | + 2\wi e w 2e \ \di2,di ei d 2e 
•j 



= E 



Pd\ 2 



2(d 



le T «2eJ 



+ 2d le d 2e J c f,(d le7 d 2e ) 

j(dle) + l(d 2 e) . V7ple) + 7(d 2 e) X ~ 



+ 



= E 



2 '4(d 



(51) 



Pd 2 2 



+ 4(di e d 2 e70( rf le, d 2e )) 2 

8(die + d 2 e)di e d 2 . 



+ 



+ \J l(d 2e )) y 70 (die, d2e) 



3 (1/P). 



(52) 



where d49l follows from the fact that d e = 
di2 a/(1 + and (f50l > follows from LemmafJ] Finally, 
we obtain 



P[/ < ft,(di — d e ) — h(di — di 2 \di 2 ) 



l - log (27rVor(di - 4)) - h{ Wl \d 12 ) 
d\ 2 pi 



< 



= -l0g<j27TE 



(53) 
(54) 



d\ 2 P 



-l{di 2 ) 



+ 4(d le + d 2 efWl{d le ) + Vl(d2e)) 2 
+ {Ad le d 2e + 64(d le d 2e ) 2 )j,p(d le , d 2e ) 
+ 8{d le + d 2e )d le d 2e (y / j{di e ) 

+ V j{d 2e )) J 70 (die, d 2e ) 
+ 64(rf le + d 2e ) 2 ( 7 (di e ) + 7(d 2e )) 



-Ie 
2 



le T "2e 

/ 27Tpi7(dl 2 ) 



log 



p 



(55) 



where (l53l follows from ( |37] > and fl39l >, (|54l follows from 
the fact that entropy of di — d e is upper bounded by the 
entropy of a Gaussian random variable that has the same 
variance as di—d e . The first term of (|55T > is obtained by 
combining combining d42l . (l48l and d52l . and the second 
term of (|55j follows from d38l ). Note that as P -> 00, the 
P terms in ( |55l l cancel each other since for any random 
variables u and u, 



lim logE 

P->oo 















- E 




p " 









log E [it] - E[log(u)], 



B. Proof of Theorem \3\ 

When the eavesdropper does not observe the angle, 
<p e = 0. Hence 

Rl= lim if/i(di|di e ,d 2e )-/i(di|d 2 )) (56) 

First, we show that the first term in d56l ) is finite. 

lim -/i(di|die, d 2e ) = lim -/i(di 2 |di e , d 2e ) 

P,n— ¥00 n n—KX> n 

1 ™ 

= lim -Y]/l(di 2 [i]|di e ,d 2 e,{di 2 L?']}}zi) 
i=l 

1 ™ 

= lim -VMdi2W|di e ,d 2e ,{^ e b1};ci) 

i=l 

1 " / 

= lim -Vfc (di e [z] 2 + d 2e [i] 2 - 



(57) 



2di e [i]d 2e Wcos(0 e [i])) a5 |d le ,d 2e ,{0 e [j]}}zi ) (58) 



> —00 



(59) 



where (l57l i follows from the fact that a trian- 
gle is completely characterized by either three sides 
{d\ 2 [i] die[i],d 2e [i]), or two sides and an angle 
(di 2 [i] di e [i], <^> e [i]). Equation ( 1581 ) follow from the co- 
sine law. Since the probability density function of 
e ,di 2 and di e ,d 2e are well defined, we can see that 
h(<f> e \i]\d le ,d 2e ,{(f) e \j]} i j l\) > -00, hence (El holds. 
The second term 



-Mdi|d 2 ) < i/i(di-d 2 ) 

n n 

= h(wi - w 2 ) 



4 < m ax7(dl 2 ) 

p 



(60) 



(61) 



< - log ^2ttE 

= i log (2ttE [4 Pmax7 (d 12 )] ) - i log(P). 

where ( f60b follows due to the fact that conditioning 
reduces entropy, doTt follows from the fact di [i]— d 2 [i] — 
wi[i] — u> 2 [£] for any i. Dropping the index i, we can 
see that h(w\ — w 2 ) is upper bounded by entropy of a 
Gaussian random variable that has the same variance as 
w\ — w 2 , which is 

Yar(wi — W2) = War(E[wi — W 2 ]) + E(Var[i0i — w 2 ]) 
= E dl2 (Var[wi - w 2 }) 

4pmax7(dl2) 



< E 



P 



Therefore, we can see that 



hence limp^oo Rjj < 00. 



lim ■ 

P^oo 



Rl 



log(P) 



> 1. 



Now, we find an upper bound on Rrj. Note that 

Ru = lim ij(di;d 2 |di e ,d 2e ) 

n— >oo 72 

< lim i(/i(di|di e) d 2e )-/i(di|di 2 ) (62) 

n— too TL 

where the first term of 
can be upper bounded as 

-/i(di|di 2 ) = h(iui|di2) 
n 



is finite. The second term 



> 



1 / 2irp 1 j{d 12 ) 

2 l0 H — p — 



= iEpog(27rpi7(di 2 ))]-ibg(P), 



therefore 



lim 



R 



u 



< 1. 



P^oo i log(P) 

Since i?L < by definition, the proof is complete. 



Appendix C 
On Observation Bias 

Nodes' observations may have bias due to several fac- 
tors. In this section, we consider two different source of 
bias; clock mismatch and multipath fading. We will see 
that different types of bias may have different outcomes. 
In this part, we present our results for the GLI case. 
However, the conclusions are valid for perfect GLI case 
as well. 



B. Multipath Fading 

There may be a bias in the observations when the 
nodes experience multipath fading. An example of this 
is time of arrival observation of distances when the nodes 
are not within their line of sight. Note that, this kind of 
bias does not remain constant, and varies from one slot to 
the other. The impact of fading can be viewed as that of 
an additional observation noise source and the distance 
observations can be written as 



dj [i] 



dn[i] + uij[i] + 



for j G {1,2}. 

Consequently, one will observe a reduction in the 
key rate. For example, with no angle observation at 
the eavesdropper, we know from Section IV-BI that the 
key rate grows unboundedly with the beacon power 
P. However, with multipath fading, independent over 
different locations, 

lim /i(di|d 2 ) = Mrjx]^) 

P->oo 



(«) 



where r/ 1 = {i]i[i]}f =1 , and (a) follows since r/ 1 and r\ 2 
are independent. Hence, following an identical approach 
to Section IV-BI one see that limp^oo Rl < oo, i.e., 
the secret key rate remains bounded even as the power 
grows unboundedly. 



A. Clock Mismatch 

Assume that there is a clock mismatch between nodes 
1, and 2. Consequently, all the observations of d\ 2 of 
nodes 1 and 2 in localization phase are shifted by a 
random value r/i and 77 2 respectively: 

dj [i] = di2 [i] + wj [i] + rjj (63) 

for j G {1, 2}, where Wj[i] is as given in (Q~|i. We assume 
the amount of clock mismatch is a non-random, but 
unknown parameter, which remains constant througout 
the entire sessiorH Since Wj [i], j G {1, 2} are zero mean 
random variables, 

E[d j [i\\r) 1 ,r )2 ]=E[d 12 [i]] + r) j . (64) 

Hence, with the knowledge of the statistics of the mobil- 
ity, each node j G {1,2} can obtain a perfect estimate 
of the amount of clock mismatch rjj as n — > oo, by 
simply calculating the difference between the long-term 
average of the distance observations dj[i] for all i and 
the known mean distance E[c?i 2 ]. Then this value can 
be broadcast in the public discussion phase. Therefore, 
clock mismatch does not affect the theoretical bounds of 
secret key generation rates. 

8 The underlying assumption is that, the clock mismatch variations 
are much slower than the duration of the key-generation sessions 
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